CVE-2026-98621
Received Received - Intake

Linux Kernel GUE REMCSUM Offset Validation Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98621
EUVD
EUVD-2026-103666

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux fe881ef11cf0220f118816181930494d484c4883
Linux Linux 4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the GUE (Generic UDP Encapsulation) REMCSUM option, which carries checksum start and offset values. If the offset is less than the start value, it causes an underflow in the skb->csum_offset variable. This can lead to a forwarded packet retaining CHECKSUM_PARTIAL and reaching a driver that trusts the metadata, causing a buffer overflow when writing checksum data beyond the intended destination.

Impact Analysis

This vulnerability could allow an attacker to cause a buffer overflow in the Linux kernel, potentially leading to system crashes, data corruption, or privilege escalation. Systems using the affected GUE feature with CHECKSUM_PARTIAL and NETIF_F_HW_CSUM drivers are at risk.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98621. Monitor vendor advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart